How severe is CVE-2023-41266?

CVE-2023-41266 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability none.

Is CVE-2023-41266 being actively exploited?

Yes. CVE-2023-41266 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-12-07, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2023-41266?

CVE-2023-41266 primarily affects Qlik Qlik Sense. In total, 36 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-41266?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2023-41266 have an EU (EUVD) identifier?

Yes. CVE-2023-41266 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-45783. It is also flagged as exploited in the EUVD (since 2023-12-07).

When was CVE-2023-41266 published?

CVE-2023-41266 was published on 2023-08-29 and last updated on 2026-08-05.

CVE-2023-41266

CVE-2023-41266 is a high-severity vulnerability in Qlik Qlik Sense with a CVSS 3.x base score of 8.2. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2023-12-07). The underlying weakness is classified as CWE-22.

Key facts

Severity: High (CVSS 3.x base score 8.2)
EPSS exploit prediction: 82% (100th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2023-12-07)
EU (EUVD) id: EUVD-2023-45783
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2023-12-07)
Weakness: CWE-22
Affected product: Qlik Qlik Sense
Published: 2023-08-29
Last modified: 2026-08-05

Description

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Frequently asked questions

What is CVE-2023-41266?: A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
How severe is CVE-2023-41266?: CVE-2023-41266 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability none.
Is CVE-2023-41266 being actively exploited?: Yes. CVE-2023-41266 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-12-07, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2023-41266?: CVE-2023-41266 primarily affects Qlik Qlik Sense. In total, 36 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-41266?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2023-41266 have an EU (EUVD) identifier?: Yes. CVE-2023-41266 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-45783. It is also flagged as exploited in the EUVD (since 2023-12-07).
When was CVE-2023-41266 published?: CVE-2023-41266 was published on 2023-08-29 and last updated on 2026-08-05.

References

Affected products (36)

cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*

More vulnerabilities in Qlik Qlik Sense

CVE-2023-48365 — Critical (CVSS 9.6): Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka…
CVE-2023-41265 — Critical (CVSS 9.6): An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and…
CVE-2019-11628 — High (CVSS 8.2): An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and…
CVE-2025-61138 — High (CVSS 7.5): Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.
CVE-2021-36761 — Medium (CVSS 5.3): The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
CVE-2022-0564 — Medium (CVSS 5.3): A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts.…

All CVEs affecting Qlik Qlik Sense →

Other CWE-22 (Path Traversal) vulnerabilities

CVE-2026-76606 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.3 - ???.
CVE-2026-18051 — Critical (CVSS 10.0): The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache…
CVE-2026-74764 — Critical (CVSS 10.0): Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a…
CVE-2026-16940 — Critical (CVSS 10.0): The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing…
CVE-2026-67429 — Critical (CVSS 10.0): Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related…
CVE-2026-59555 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

Browse all CWE-22 (Path Traversal) vulnerabilities →